Live data from Hacker News

Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

youtube.com

331–340 of 434 posts

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#331

Earlier quoted context omitted.

Insecurity through obscurity is possible even in open source. See log4j, but there are other examples — and infinite proof of concepts of people breaching repositories. Even on the desktop, you want multiple layers of security to limit potential damage. Do use Linux on the desktop and be happy if it makes you happy, but don’t smugly assume you’re immune to the outside pressures in today’s world that are causing Apple…

Well yes but Linux has had solutions for this a long time. AppArmor, SELinux. Some distros like RHEL already bundle apps with profiles that make sure the app can only do what it's supposed to do.

SELinux in particular is complex enough many vendors just give up and write "disable SELinux" in install manual...

Also it is totally not fit for the "ask user for permission" model.

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#332
post #243

Earlier quoted context omitted.

I type "volume" in the search field and pick the right option?

Now do it with a cup of coffee in one hand and a mouse in the other.

Maybe they should make special operating systems just for people who constantly hold something in their one hand while clicking around with the other.

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#333
post #286

Earlier quoted context omitted.

By whatever mechanism the OS has to verify that you have the privilege. E.g. sudo. Not by raising a plethora of hurdles.

An admin password prompt is hardly a deterrence to people doing stupid things. A young physics PhD friend of mine fell victim to a tech support scam, happily installing whatever spyware “Apple Support” told her to install over phone. That was a few years ago. The average person is too easily social engineered into allowing anything.

At what point do we say "that's her own fault"? How do we evolve to be alert to threats if we just hide them away and take agency from individuals?

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#334
post #80

Earlier quoted context omitted.

An Intel NUC is not much more than the top tier Raspberry Pi, once you get a case and stuff it needs, but is orders of magnitude faster. I got one and installed Linux Mint on it. It's a much, much better system than the Raspberry Pi 4 I have.

Either you have found an amazing discount for NUCs or you're getting ripped off on your raspi accessories!

It may depend on one's definition of "not much more". I got my Intel NUC in the barebones configuration since I already had spare 32GB of RAM and an SSD for $387.59. To me, that's not much more than the highest end Raspberry Pi 4 with a case with a heatsink and fan because the NUC: actually works and is usable, has DisplayPort and just generally better I/O aside from the Pi's GPIO, configurable memory, and better CPU and GPU. Plus, you can actually buy one. To me, that's worth it.

My Raspberry Pi's are just unusable for anything other than as high-level embedded platforms. I've started selling them off, only keeping one or two for embedded use cases.

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#335
post #109

Earlier quoted context omitted.

I don't know the exact issues but might be related to the issues why I left Apple : I was developing a very successful little tool for MacOS ( https://github.com/milgra/macmediakeyforwarder ) which listened for keypresses. From 2016 to 2019 it became harder and harder to install it because apple added more and more restrictions to apps like this. By 2019, you had to enable the application explicitly to listen for eve…

using Second Reality as the music for the swayos video was a pleasant surprise

I'm glad you liked it! I miss the golden age of tracker music/demoscene.

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#336

Earlier quoted context omitted.

"Random third party binaries" are not something Linux users really use, generally. Most of it is open source and comes through the repository.

every package system (apt/yum/pkg/whatever) is distributing binaries. So yeah, the upstream project can be open source, but there is 0 guarantees that the binary I install on my system is the exact same binary as I would get if I build the source myself (and this does not even touch on the subject that compilers can add weird stuff as well) Sure, it's better than closed source, because at least you have the possibili…

there is 0 guarantees that the binary I install on my system is the exact same binary as I would get if I build the source myself

not true, for years there are efforts in various distributions to make package builds reproducible. there are ways to build a package from source that allows you to get the same results and verify it.

we outsource this responsibility to the package maintainer

which is the point. i trust the package maintainers to do a better job at that than myself.

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#337
post #182

Earlier quoted context omitted.

I can understand distributions not having optimal settings for every laptop under the sun, but it seems like a no-brainer to at least create a repository of power config profiles for different models that users can submit to, eventually creating a decent library that could then be integrated into the settings app or and first run wizard.

Whilst not strictly for power settings, NixOS has a repository where users can contribute general optimized settings for their hardware. https://github.com/NixOS/nixos-hardware

Not sure why this is downvoted, that's awesome on NixOS's part.

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#338
post #277

Earlier quoted context omitted.

This is a bizarre argument. Do you feel the same way about Windows finally starting to take security seriously back in the mid 2000s?

Security should never come as an after-thought. This especially holds for complex systems with multiple stakeholders, like OSes.

So what should happen when the threat model changes? Just abandon all software, ossify it in a poor state, or something else?

You always to be advocating for ossification to avoid breaking apps which are no longer ok under an evolved threat model.

Finally, you didn’t actually answer the question I asked. It’s all very well and good to say how things should be, but people have to face the world as it actually is instead.

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#339
post #237

Earlier quoted context omitted.

"Random third party binaries" are not something Linux users really use, generally. Most of it is open source and comes through the repository.

Yeah, because I definitely double check the provenance of the 30 dependencies that blow past my terminal when I apt install something, that I also very much looked into and aren’t blindly typing commands from Stack Overflow into my terminal because I’m trying to solve some problem.

because I definitely double check the provenance of the 30 dependencies that blow past my terminal when I apt install something

why would you? that's the package maintainers job. each of these dependency also has a maintainer, so by definition all dependencies have a provenance that is as good as the package you are installing.

this is not npm where anyone can upload something and you have to check the provenance of each yourself

Re: Ken Thompson's 75 year project: A century of popular music in a jukebox [video]

#340
post #189

Earlier quoted context omitted.

Better headline: “Unix Legend Ken Thompson Announces he is Switching From iTunes to a Raspberry PI, a Player Piano and Cabinets of old CD’s” Hmmm. I meant for that to be snarky, but it is a better headline.

Apple music is only 10 bucks a month and lossless. But that is pretty cool.

today it is. tomorrow it might not be at all. or it might be $100/mo. or they might decide they need interstitial ads. or only if you use their recommendation engine with preselected 'channels'

the computational requirements to store and play music are so minimal now, I'd rather just take care of it myself

Post reply on HN